CVE-2021-44554

Name of the Vulnerable Software and Affected Versions: Thinfinity VirtualUI versions prior to 3.0

Description: The issue allows a malicious actor to enumerate users registered in the Windows operating system through the "/changePassword" URI. By accessing this vector, an attacker can determine if a username exists thanks to the message returned, which can be presented in different languages according to the configuration of VirtualUI. Common users that may be targeted include administrator, admin, guest, and others.

Recommendations: For Thinfinity VirtualUI versions prior to 3.0, update to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/changePassword" URI until a patch is available.